In a corporate environment, a software development team is integrating a third-party application that requires access to user data stored in Microsoft Graph. The application needs to perform actions such as reading user profiles, sending messages on behalf of users, and accessing calendar events. The team must configure the appropriate API permissions and scopes to ensure that the application functions correctly while adhering to the principle of least privilege. Given this scenario, which combination of permissions and scopes should the team request to achieve the required functionality without over-permissioning?